lew-imagegen-cloth

• Outcome: Review
• Latest audit: Aug 3, 2026 · 4:05 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches clothing image generation, but it includes overbroad local script execution and a runtime path to install another remote skill during auth recovery.

Review before installing. This skill will run local Python helpers, call Linkfox text/image generation skills, and write session files containing product imagery metadata and generated outputs. Only use it in an environment where the sibling Linkfox skills are trusted, avoid letting untrusted prompts or edited state files set script paths, and treat the remote onboarding-skill install flow as requiring explicit separate approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_textgen(textgen_script: str, params: dict, task_id: str) -> str:
    """调官方 aigc_textgen.py --stdin --content-only，返回单行 content（换行为 ⏎ 占位符）。"""
    proc = subprocess.run(
        [sys.executable, textgen_script, "--stdin", "--content-only"],
        input=json.dumps(params, ensure_ascii=False),
        text=True,

• Confidence: 92% confidence
• Finding: proc = subprocess.run( [sys.executable, textgen_script, "--stdin", "--content-only"], input=json.dumps(params, ensure_ascii=False), text=True, capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_imagegen(imagegen_script: str, params: dict, task_id: str) -> list[str]:
    """调官方 aigc_imagegen.py '<json>'，解析 'Saved full response:' 判定成败。"""
    proc = subprocess.run(
        [sys.executable, imagegen_script, json.dumps(params, ensure_ascii=False)],
        text=True,
        capture_output=True,

• Confidence: 93% confidence
• Finding: proc = subprocess.run( [sys.executable, imagegen_script, json.dumps(params, ensure_ascii=False)], text=True, capture_output=True, timeout=IMAGEGEN_TIMEOUT, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes shell commands, reads and writes local files, accesses environment variables, and makes network requests, yet declares no permissions or capability boundaries. This creates an authorization and review gap: operators and downstream tooling cannot accurately assess what the skill is allowed to do, making misuse or overreach harder to detect.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill expands from clothing image generation into onboarding, authentication recovery, and installation flow for another skill. That broadens the trust boundary and gives the skill a path to perform unrelated actions, increasing the chance of unexpected code execution, supply-chain risk, and user confusion during failure handling.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Authorizing download of a remote ZIP and installation of another skill is a clear supply-chain and remote-code risk unrelated to the core clothing-image function. If abused or if the remote artifact is compromised, the agent could import unreviewed instructions or executable content into the environment.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The template’s stated purpose is size-chart design, but it also directs generation of realistic human models from clothing images, including explicit support for children. That expands the skill from product-layout generation into synthetic person generation without a clear necessity, increasing safety, consent, and policy risk—especially where uploaded images may be repurposed to create realistic people.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The template instructs the system to infer or randomly assign age and gender for generated people based on clothing category, including deciding whether subjects should be adults or children. This is unnecessary for core size-chart functionality and introduces sensitive demographic inference plus arbitrary person creation, which can misclassify users and enables generation of child depictions without explicit need or consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This line explicitly mandates generation of child models whenever the clothing category is identified as children’s apparel. Automatic creation of realistic child models materially raises safety risk because it normalizes unnecessary minor depiction generation in a commercial imaging workflow and broadens exposure to misuse scenarios involving children.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The template hard-codes 'European/American' faces as a required model attribute, which is unrelated to producing a functional clothing size chart. This embeds biased demographic selection into the generation pipeline and can create discriminatory or exclusionary outputs without user justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the system to persist brand gene extraction results and image plans to session storage, including absolute file paths, but provides no user-facing warning or consent mechanism. This creates a privacy and data-governance risk because uploaded product imagery and inferred brand attributes may be retained and reused beyond the user's immediate expectation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill defaults human depictions to '欧美人' unless the user specifies otherwise, which hard-codes a sensitive demographic attribute without consent or necessity. In an image-generation workflow, this can systematically bias outputs, misrepresent intended subjects, and create fairness and compliance issues, especially in consumer-facing content generation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to persist user-derived planning data to disk and invoke shell/Python commands, but it provides no user-facing disclosure or consent step about storing data in $DATADIR. In this skill context, the persisted content can include user-provided product and image-plan details, so silent persistence increases privacy, retention, and cross-step misuse risk even if the commands are operationally legitimate.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The document requires the agent to include a specific model-description statement in the task tool's `description` field, regardless of whether the user requested or consented to that disclosure. This can lead to unauthorized or misleading disclosure about backend model usage, and may pressure downstream behavior into making fixed claims that are inaccurate, policy-sensitive, or not user-driven.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill instructs the agent to directly read, modify, and write back `image-plan.json`, including deleting and appending tasks, but does not require any explicit user confirmation or warning that existing plan data may be overwritten. In a workflow that revises generation plans, this creates a real risk of unintended destructive changes, especially if the user's modification request is ambiguous or partial.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly defaults to '欧美商业模特' when users do not provide stronger constraints, which bakes a demographic assumption into image generation without opt-in. In an ecommerce image workflow this can systematically misrepresent target customers, introduce biased outputs across markets, and create compliance or brand-representation issues for sellers serving non-Western audiences.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The known-limitation text reiterates that the pipeline will default to Western commercial models unless the user overrides it via imageDesc, confirming the biased behavior is intentional product behavior rather than incidental wording. This strengthens the risk because operators may rely on the documented default and deploy it broadly, causing repeated biased representation in generated catalog imagery.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly states that when demographic attributes are not specified, it defaults to European/American models. This hard-coded ethnicity/locale default can introduce biased or inappropriate outputs without user consent, and in a consumer-facing image generation workflow it may systematically misrepresent products, audiences, or brands for users in other regions.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The skill hard-codes that adult size-guide imagery uses '欧美模特' and explicitly ignores salesRegion/platform, which creates a biased and non-user-aligned generation policy. While not a classic code-execution flaw, it is a real safety/quality vulnerability because it can systematically produce exclusionary or inappropriate outputs for different locales, brands, or audiences.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: The checklist operationalizes the same restriction by requiring all three models in the three-panel layout to be European/Western. This makes the bias actionable at runtime and increases the chance of consistent discriminatory or culturally mismatched outputs, especially in commerce contexts where representation should follow market or user requirements.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The known-limitation section confirms the behavior is intentional in the design: model appearance never changes with salesRegion. That means the issue is systemic rather than incidental, making misuse or harmful mismatch more likely across deployments and harder for downstream systems to correct.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template hard-codes a default of English / Amazon / US when language, platform, or salesRegion are empty, which can cause generation in a language or market context the user did not request. In this image-generation skill, the issue is primarily product/UX and policy-related rather than a direct security exploit, but it can still lead to incorrect region-specific content, compliance mismatches, or user intent override.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The initialization text invites users to 'upload images and give instructions' in a very broad way, without clearly constraining the skill to clothing-specific workflows. In an agent system that routes by prompt similarity, this can cause the skill to activate on generic image-generation or editing requests, leading to misrouting, policy bypass opportunities, or application of clothing-specific transformations to unrelated content.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The template states that, unless the user specifies otherwise, it will create a 'default' model with a specific ethnicity/market-coded appearance ('欧美商业模特'). This imposes a sensitive demographic default without user opt-in, which can create biased or inappropriate outputs and may violate product fairness or localization expectations in commercial image generation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template explicitly defaults to generating '欧美模特' when the user does not specify a target audience, which hard-codes an ethnicity/locale preference into model selection without user consent. In an image-generation skill for commercial fashion content, this can systematically bias outputs, misrepresent intended markets, and create discriminatory or exclusionary behavior at scale.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The template accepts many user-controlled fields such as brandKey, customer_keywords, layoutInfo, language, infringingWords, and customSetting and instructs the model to directly transform them into final output with only weak isolation rules. In a prompt-based skill, broad and underspecified handling of these fields increases prompt-injection risk, policy bypass, malformed output, and unsafe or noncompliant content generation because attacker-controlled text can steer the model in unintended ways.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.